The Microsoft file ecosystem presents multiple attack vectors which threat actors can exploit with relative ease, and object linking & embedding (OLE) is one major example. Malicious external links and objects can be injected into valid documents through this feature, and if these documents are left undetected, unsuspecting users can…

We can define an unsafe archive as any compressed file format with an extraction outcome that negatively impacts (or fully compromises) our system. Perhaps the most common example of this is a .ZIP bomb — an archive overloaded with data intended to crash our system once extracted. It’s critically important…

The security of our most sensitive web applications depends entirely on the strength and scope of the policies we put in place to protect them. Securing our applications starts with implementing powerful anti-virus and anti-malware policies, but it should also include policies against non-malware content threats, too. Allowing uploads from…

Insecure deserialization vulnerabilities represent one of the more common attack vectors pursued by threat actors in the modern day. Poorly configured data parsers can be tricked into passing harmful data into an application’s code base, and this mishap can trigger a variety of disastrous outcomes, including the infamous Denial of…

Poorly configured XML parsers are sometimes vulnerable to XXE (XML External Entity) threats. If a threat actor becomes aware of an XXE vulnerability in an application’s data parser, they can exploit it to retrieve sensitive data from the underlying application server with relative ease. Thankfully, XML External Entities can be…

The threat posed by MS document macros is nothing new. Since the introduction of macros almost 30 years ago, threat actors have leveraged this built-in file automation feature to programmatically unleash malware onto systems of all shapes and sizes, and they’ve done so with devastating effectiveness in many cases. This…

Password protected files are a tried & true cyber-attack vector, allowing threat actors to inject malicious code into a system by hiding it behind the security and encryption features built into many common file formats. Since attacks using password protected files are typically carried out with social engineering tactics (i.e…

If we aren’t careful, motivated threat actors can compromise our system by injecting malicious scripts into seemingly innocent file formats. If we don’t detect these files right away, both internal and external system users are at major risk of losing valuable data, and our system might even be compromised entirely. …

Any time we allow external users to upload files to our storage instances, we need to implement rigorous anti-virus, anti-malware, and content verification policies to keep our systems safe. Using the free API provided in this article, you can easily scan files for virus, malware, and non-malware threats — including…